2311 lines
No EOL
80 KiB
JSON
2311 lines
No EOL
80 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "1",
|
|
"date": "2020-03-24",
|
|
"extends_uuid": "5e6f3fa2-ed28-484c-97ad-4b9e02de0b81",
|
|
"info": "OSINT - Pivot from IP address (105.235.129.138) where the C2 was running",
|
|
"publish_timestamp": "1585060854",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1585060842",
|
|
"uuid": "5e7a18bc-abe8-4fc7-ab5f-4ae1950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"name": "osint:lifetime=\"perpetual\""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"name": "osint:certainty=\"50\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C2 seen in RevengeRAT",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060200",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5e7a1968-b19c-41dd-b781-1930950d210f",
|
|
"value": "105.235.129.138"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060309",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d5-45b4-4bea-bf5b-46ca950d210f",
|
|
"value": "44a072d0d5f531d245f1d4afdd698045"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-db94-4f91-82bf-490f950d210f",
|
|
"value": "491576d3fa9656a2e7dfb04853054d20"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-ae7c-4818-b93d-43d8950d210f",
|
|
"value": "dfb087fc27d6ae637dfe9dc5815f8d69"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-9eb0-4d30-89ed-4df2950d210f",
|
|
"value": "e64bd29b1927aed005addefe3a67f4c0"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-cb24-46b0-b1c7-47d3950d210f",
|
|
"value": "82ea81845bf0e7da6cde6ce688a27e93"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-4c30-46e5-b66b-4555950d210f",
|
|
"value": "c93e9d4ebc7cd210003ada07c7bf08b6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-9cdc-4f5b-813a-41a8950d210f",
|
|
"value": "725e847eca66f9fd882239a73ae066d1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-ccf8-4693-bdd8-4005950d210f",
|
|
"value": "53d4d4cc977362c09fd466bb676567c8"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-5a70-4037-8f86-42e0950d210f",
|
|
"value": "38881d950eb4269b047ff95f2f5c1ba3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-8680-4702-84c5-4a82950d210f",
|
|
"value": "3bf3208b13b3fa71fed6e982ea97ba24"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-633c-441c-9fe9-4f14950d210f",
|
|
"value": "d08e5af0738841307d920b0da3fea555"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-c98c-4a7a-9b89-4f0a950d210f",
|
|
"value": "3ed826708dd257795420951450b3986c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-429c-4715-bb1f-479e950d210f",
|
|
"value": "4e713b040bd5fcf38533c4fbab817a0a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-9928-4b34-8fd0-4769950d210f",
|
|
"value": "2c323b2676106a7d1952cb8a2765b307"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-5950-44c9-8eca-4718950d210f",
|
|
"value": "7434cdc8b2e9b33d195a38ce795a06e5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-21fc-4005-8088-4fc2950d210f",
|
|
"value": "3019d4ae2c559ac4dbf531acfc3fa780"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-66c4-4a2f-bfd2-4894950d210f",
|
|
"value": "fea3e01abc57cef587c2383d488fd98a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-8bcc-4f0f-bda9-4e54950d210f",
|
|
"value": "34a485d7ab1c84b0f925e88b008b2c53"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5e7a19d6-0770-4af0-97b4-466e950d210f",
|
|
"value": "fbebccbe2a1665199b46dcb21634b71d"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060579",
|
|
"uuid": "f76a681a-8320-432a-971c-d6af19b497f8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "f76a681a-8320-432a-971c-d6af19b497f8",
|
|
"referenced_uuid": "432f1504-8445-4a8e-a7eb-883ba6b0b52e",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-9d48-4306-ade5-40b702de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "7f6971df-d6c0-4d61-9a6c-66638da47ae3",
|
|
"value": "53d4d4cc977362c09fd466bb676567c8"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "252b890f-892f-4dfc-8359-66268ff68f84",
|
|
"value": "721ca63682c4a34c86585f80eceead43f20e10f3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "847a8b47-f1f8-440b-8ed0-dc6b05ada3a2",
|
|
"value": "5e94b03664c3674f3eab1e750ffde61d3d21d938ec0ce21f6f64bc9362aeb084"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060580",
|
|
"uuid": "432f1504-8445-4a8e-a7eb-883ba6b0b52e",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "5f231374-0e4a-4514-be39-783f8a1b4464",
|
|
"value": "2020-03-24T11:50:00+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "89498e6d-c95c-4e50-b58c-e2d0cca2693a",
|
|
"value": "https://www.virustotal.com/file/5e94b03664c3674f3eab1e750ffde61d3d21d938ec0ce21f6f64bc9362aeb084/analysis/1585050600/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "d7592b9e-6331-45ce-beb8-8cc626a54caa",
|
|
"value": "53/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060580",
|
|
"uuid": "5d9c7cce-7ad2-4479-9ab0-8d1e0cafc544",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "5d9c7cce-7ad2-4479-9ab0-8d1e0cafc544",
|
|
"referenced_uuid": "25a1e4ec-1fef-4774-8c69-eff8d494e892",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-1e94-43bc-a1de-400c02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "78bd923d-816d-4878-ae41-32a0e5a92f7e",
|
|
"value": "38881d950eb4269b047ff95f2f5c1ba3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "f25a1947-696d-4414-906b-420ce46c377c",
|
|
"value": "d3fb78a1ae45330b4b7231559b9c7aa81b19904c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "8043865f-e4c3-427f-8d40-2a56b50b4ee3",
|
|
"value": "6432378da1a760f6eb9e3a02eda5433a91f3dc056948269c04a8cfae0c7831f0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060580",
|
|
"uuid": "25a1e4ec-1fef-4774-8c69-eff8d494e892",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "6e37e8c5-9059-4d5e-bbc3-0cc82ed3bbff",
|
|
"value": "2020-03-20T02:24:25+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "a724a99b-4bd6-4c12-9e8a-b52b4d287fa4",
|
|
"value": "https://www.virustotal.com/file/6432378da1a760f6eb9e3a02eda5433a91f3dc056948269c04a8cfae0c7831f0/analysis/1584671065/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e779adf9-1b7c-4cb4-8502-7336b868f2d4",
|
|
"value": "49/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060580",
|
|
"uuid": "204301ea-d686-4d16-9981-9bd004e4afb8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "204301ea-d686-4d16-9981-9bd004e4afb8",
|
|
"referenced_uuid": "b5b7c881-daec-4fc8-a43b-83344548d6e4",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-81cc-44fb-a0b9-4e8602de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "80e28052-8af0-4884-950c-863c3c00db4c",
|
|
"value": "491576d3fa9656a2e7dfb04853054d20"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "0cadb14d-f311-4341-8b63-f48031c17ed1",
|
|
"value": "1ee3b37f196d0d94634fb89e4298ebbe014b3da1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "e731059e-28d8-4dc9-a4cd-f306f27f30c7",
|
|
"value": "053aea685891f94d757153fea5829ab89fe2d09007c584bd4bac62c65ec801ed"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060580",
|
|
"uuid": "b5b7c881-daec-4fc8-a43b-83344548d6e4",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "745bd7e6-3eb9-4957-9607-06b572104230",
|
|
"value": "2020-03-20T02:16:41+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "95751986-8055-4a4e-801c-32aebe01deca",
|
|
"value": "https://www.virustotal.com/file/053aea685891f94d757153fea5829ab89fe2d09007c584bd4bac62c65ec801ed/analysis/1584670601/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "1cbd68b1-86bc-4435-90f5-c7e2032539c7",
|
|
"value": "46/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060581",
|
|
"uuid": "3d55c00e-a69f-4227-bf8c-7566418430b8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "3d55c00e-a69f-4227-bf8c-7566418430b8",
|
|
"referenced_uuid": "75899f14-fde0-470c-8a97-73d10c6228e5",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-3f7c-45c9-8e45-40d302de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "39d3d9fc-ad2d-496d-b91c-3c2042f93cfd",
|
|
"value": "fea3e01abc57cef587c2383d488fd98a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "aefbe112-4526-42e8-b403-33262489c401",
|
|
"value": "5ca083ae368e9848c7f5602f09dea1cac2d2c05d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "cd32c386-cf19-4cf7-bc83-0d63c8889001",
|
|
"value": "be5d07b405aea2c17b26ecb4cea2ce64c6a996019768d5334d5e3ebf90818b52"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060581",
|
|
"uuid": "75899f14-fde0-470c-8a97-73d10c6228e5",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "36e4c74d-c95f-4143-98ed-349fb82b09e2",
|
|
"value": "2020-03-16T10:09:04+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "df067739-59cd-49e0-a319-9e895e7e3126",
|
|
"value": "https://www.virustotal.com/file/be5d07b405aea2c17b26ecb4cea2ce64c6a996019768d5334d5e3ebf90818b52/analysis/1584353344/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "538c3ff0-a3c5-415b-91b2-4a144decdf7f",
|
|
"value": "0/63"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060581",
|
|
"uuid": "20d43fe6-f333-4e0a-b4e5-bed417807b67",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "20d43fe6-f333-4e0a-b4e5-bed417807b67",
|
|
"referenced_uuid": "1b7e0ae2-7040-4243-b455-426833f0610e",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-4a0c-4c61-b8f7-4f5f02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "c633c4f6-7fee-4d2d-ba3b-e29ebd58de00",
|
|
"value": "2c323b2676106a7d1952cb8a2765b307"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "9ca8b23c-642e-47ec-9469-02524aa11854",
|
|
"value": "68314c818b251aa2034675cd2b62db14a392a3de"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "6fabd85b-d6cb-48b2-b9ff-7e18187640b6",
|
|
"value": "6b322007395cfdf163596e62575c52f0123c5f4a8b49407f8d4364b44299d5d1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060581",
|
|
"uuid": "1b7e0ae2-7040-4243-b455-426833f0610e",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "21ab625b-6023-433b-8272-fdc79cd8298d",
|
|
"value": "2020-03-19T07:13:21+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "1392c9fd-c405-49c1-bf03-e29b05ca4874",
|
|
"value": "https://www.virustotal.com/file/6b322007395cfdf163596e62575c52f0123c5f4a8b49407f8d4364b44299d5d1/analysis/1584602001/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "cd124ee7-363e-4d68-bb19-826e9904898d",
|
|
"value": "43/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060581",
|
|
"uuid": "8b47a154-fc00-4edf-b90a-d03cf5552b95",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "8b47a154-fc00-4edf-b90a-d03cf5552b95",
|
|
"referenced_uuid": "e13e2f5a-e8b3-4115-9d02-ef2c09335cba",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-d904-43c7-8b23-41e902de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "7ec29a26-0fba-4f28-9a8c-0aad9e10981a",
|
|
"value": "7434cdc8b2e9b33d195a38ce795a06e5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "bf25080d-a63f-4745-b5b9-9a1d60eeac2a",
|
|
"value": "2544b6f5ed98151d36d466d2377897703c85a12e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "0f696869-be9b-48f6-8a82-1f615297ddfb",
|
|
"value": "fe53c08e692d7ef6bfd379f9f34d48bd1f4b8c1c72c6d8d33d6e9ca234414aa9"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060582",
|
|
"uuid": "e13e2f5a-e8b3-4115-9d02-ef2c09335cba",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "2e407895-02cf-4b56-8578-bb6b1fb3b623",
|
|
"value": "2020-03-17T09:22:54+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "51adb1f2-d3f3-4fd6-b02f-1dbb6961a9ef",
|
|
"value": "https://www.virustotal.com/file/fe53c08e692d7ef6bfd379f9f34d48bd1f4b8c1c72c6d8d33d6e9ca234414aa9/analysis/1584436974/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b567561e-685a-4290-be4b-704c6179c4fd",
|
|
"value": "43/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060582",
|
|
"uuid": "ec2159c6-1e9d-42eb-8d30-4c324682727f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "ec2159c6-1e9d-42eb-8d30-4c324682727f",
|
|
"referenced_uuid": "0fb8dde5-db9d-4325-ab53-0e7404037f2f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-0310-4d52-9a62-42be02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "0c6e47c6-06af-492e-b76d-83dfaaaad6e5",
|
|
"value": "fbebccbe2a1665199b46dcb21634b71d"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "a5260bd9-3af9-42d0-869e-5cbcd5ae8256",
|
|
"value": "bbb1d9b5468b16c8f27ae43fbf0f4ef3f7ddbff7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "6decc643-8dcd-4d2f-931d-c5d25e59cfe6",
|
|
"value": "846f37da180b23f1e5a314fcf9d3804ea398ce6eead594bcff614f1384160c57"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060582",
|
|
"uuid": "0fb8dde5-db9d-4325-ab53-0e7404037f2f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "fe997fa5-c948-4956-98cd-eb0093018b05",
|
|
"value": "2020-03-19T06:13:08+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "4c98e2a0-64e3-4aa8-b3d9-b99a68c8d6c2",
|
|
"value": "https://www.virustotal.com/file/846f37da180b23f1e5a314fcf9d3804ea398ce6eead594bcff614f1384160c57/analysis/1584598388/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "ba9b9f51-e769-433e-906d-1d453778e5e8",
|
|
"value": "48/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060582",
|
|
"uuid": "d348d543-7258-4136-9561-fdcb09094cf8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "d348d543-7258-4136-9561-fdcb09094cf8",
|
|
"referenced_uuid": "77435506-8369-4930-8582-b36ca661fd4e",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-3254-4eef-9511-43d802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "05e05767-3a95-424e-9002-339075c11e9c",
|
|
"value": "e64bd29b1927aed005addefe3a67f4c0"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "4ca678e5-7020-440d-ab11-4181644b06a3",
|
|
"value": "83c0bd612bb435245cb6f76b0ba18c1d4450c9ef"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "d9c0288d-9211-4b78-bf51-0442bb64384b",
|
|
"value": "33e8487c8a72debf50a23376a9127cba419f9515fb053dd24d2c0ed302243318"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060582",
|
|
"uuid": "77435506-8369-4930-8582-b36ca661fd4e",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "773fd8e1-786e-4223-8547-ec28c332ff54",
|
|
"value": "2020-03-19T02:57:26+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "e8dffea3-5df3-410a-b59c-2e77155aeb64",
|
|
"value": "https://www.virustotal.com/file/33e8487c8a72debf50a23376a9127cba419f9515fb053dd24d2c0ed302243318/analysis/1584586646/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "e7aa7dac-d23f-49e1-92d9-6acd8ed7c04a",
|
|
"value": "46/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060582",
|
|
"uuid": "d99b5879-0d8e-4974-bdcd-7d07cda14e8f",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "d99b5879-0d8e-4974-bdcd-7d07cda14e8f",
|
|
"referenced_uuid": "e15b15b3-8717-4f39-8320-50589c8c41c0",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-9ba4-415d-a58c-4fb902de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "2f70a233-21e5-4838-a66f-a0c066d4faee",
|
|
"value": "dfb087fc27d6ae637dfe9dc5815f8d69"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "b04742c7-cfc0-4d74-bb24-c3cc6fbb9262",
|
|
"value": "f04c5549d76d04869e1b0bf9955dfc3f00cab8ff"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "7298d9fb-0237-40fd-a616-b0d87aaf7e1d",
|
|
"value": "69999d817290dc8211d359cd719de6b3c440f99b9ab84c34ce4ab405a1f5135e"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060583",
|
|
"uuid": "e15b15b3-8717-4f39-8320-50589c8c41c0",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "10d6e461-b479-4b0a-8dd7-add503d19e24",
|
|
"value": "2020-03-20T02:00:30+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "a7ce8ed8-f56c-4376-b1c1-83eee0b11383",
|
|
"value": "https://www.virustotal.com/file/69999d817290dc8211d359cd719de6b3c440f99b9ab84c34ce4ab405a1f5135e/analysis/1584669630/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "fdf47deb-a49b-4af3-bcd9-fc69f254411f",
|
|
"value": "48/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060583",
|
|
"uuid": "3db629ff-cb1a-4e1b-800d-7d569005b015",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "3db629ff-cb1a-4e1b-800d-7d569005b015",
|
|
"referenced_uuid": "77febe5a-7f90-45b1-bb57-1d99f458fd78",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-64b4-4401-a969-4d4402de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "64747633-445b-4eb1-b889-6f9832e0a0d8",
|
|
"value": "d08e5af0738841307d920b0da3fea555"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "3652c836-ed12-4aac-8eeb-b54e2156038c",
|
|
"value": "044c07dc58da47445dcb1b7bcbe35896fcda6403"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "db38e08b-5e1a-4a05-b484-23ac0215b7a5",
|
|
"value": "7bf85eaa32be3f39c824168cbef850dfe17914b84078930ddc0fe6c1691ae29b"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060583",
|
|
"uuid": "77febe5a-7f90-45b1-bb57-1d99f458fd78",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "67184b05-f8ca-4e1c-bd15-0a054e3933d6",
|
|
"value": "2020-03-21T18:00:18+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "b40be2fd-3ba1-416d-a95e-fb571d8982bb",
|
|
"value": "https://www.virustotal.com/file/7bf85eaa32be3f39c824168cbef850dfe17914b84078930ddc0fe6c1691ae29b/analysis/1584813618/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5771d627-a23b-4abb-9698-e68c3fb6938c",
|
|
"value": "12/59"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060583",
|
|
"uuid": "71633f2d-548f-4a5c-9d94-977cc1e9d480",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "71633f2d-548f-4a5c-9d94-977cc1e9d480",
|
|
"referenced_uuid": "15954897-e5fa-466a-a676-a421b2523bf2",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-4104-4e13-a1ce-439402de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "94f7c364-03e6-4847-92a7-8abb5f83c634",
|
|
"value": "3019d4ae2c559ac4dbf531acfc3fa780"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "4309ccae-2570-4ae7-877f-9f94b0d8df78",
|
|
"value": "816394af6c74dfd85c493ed8e440679531ff3f40"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "06699745-cc85-4c60-b889-36a5fb86a21d",
|
|
"value": "ac01b105cd96549cb4360e3a919624c1fff57aa902cb897042ff8b8a19b20007"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060583",
|
|
"uuid": "15954897-e5fa-466a-a676-a421b2523bf2",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "a520da6f-3020-4c98-b9e6-f053eb84cb4b",
|
|
"value": "2020-03-19T11:41:15+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "6b332797-ea40-4337-8bde-696c7b046655",
|
|
"value": "https://www.virustotal.com/file/ac01b105cd96549cb4360e3a919624c1fff57aa902cb897042ff8b8a19b20007/analysis/1584618075/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "4128d7ae-ab72-422e-a107-f96eea3f5c26",
|
|
"value": "44/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060583",
|
|
"uuid": "e573e735-58a3-45d0-9238-b5b61723b376",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "e573e735-58a3-45d0-9238-b5b61723b376",
|
|
"referenced_uuid": "e5cec23a-f3eb-4505-9acb-c7384f488c9d",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-ed20-4f9d-a411-4f8402de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "d10ef4df-1459-477c-87c3-f3b25a87cfd4",
|
|
"value": "82ea81845bf0e7da6cde6ce688a27e93"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "d0af7775-ad5a-4bbc-9f52-15db82596cd7",
|
|
"value": "eab91506996ca7061e689d8197c8c70aae446a69"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "65d5e442-ffe5-4346-b14f-7195fc8abefa",
|
|
"value": "06bf3044c702c820aca25ece35cf76d13df0d806d164df573a89f0b9d08132f1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060584",
|
|
"uuid": "e5cec23a-f3eb-4505-9acb-c7384f488c9d",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "03248e8c-ea25-4566-80dd-f03426f010e1",
|
|
"value": "2020-03-19T03:15:13+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "24c8a319-1dcc-4f4a-a930-ee04e90a8d47",
|
|
"value": "https://www.virustotal.com/file/06bf3044c702c820aca25ece35cf76d13df0d806d164df573a89f0b9d08132f1/analysis/1584587713/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "c30c27f5-ba27-4ca9-abcb-56bc025a4a06",
|
|
"value": "44/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060584",
|
|
"uuid": "b8fe9dc2-a017-44f3-8c66-4b75c18b2a7c",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "b8fe9dc2-a017-44f3-8c66-4b75c18b2a7c",
|
|
"referenced_uuid": "0c2996b2-a4d4-428f-833e-c9d476cd0084",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-96cc-417b-ae8a-415502de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "3d1d8913-dc25-4bfa-8172-576b21d7ba71",
|
|
"value": "4e713b040bd5fcf38533c4fbab817a0a"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "837d69a4-c031-4401-a657-1f1b629d2039",
|
|
"value": "d35eb5ca2ca01f2aaac9dc4357743fdca3682738"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "12777d51-3421-4d12-a6ff-78abc25a1f16",
|
|
"value": "44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060584",
|
|
"uuid": "0c2996b2-a4d4-428f-833e-c9d476cd0084",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "e7ac84b1-17c8-4a22-a72f-2c76aa531f56",
|
|
"value": "2020-03-24T00:05:29+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "54298460-16af-411e-90ae-762601c54e3d",
|
|
"value": "https://www.virustotal.com/file/44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8/analysis/1585008329/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "ee1f6192-aba9-42c5-8fbb-d986260fc8c9",
|
|
"value": "10/59"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060584",
|
|
"uuid": "37b61c47-5345-472c-ad8a-7c42424eec35",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "37b61c47-5345-472c-ad8a-7c42424eec35",
|
|
"referenced_uuid": "19556fee-a174-4697-ba43-73fde89f550f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-e20c-40ee-957a-48d502de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "d187845d-ed1f-4f45-950b-c0cb63772c00",
|
|
"value": "3ed826708dd257795420951450b3986c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "05d9743c-85cc-4066-87c3-0767a0debb96",
|
|
"value": "b8a684cdb0c36b4a9c11964c014bad3dff0b2edf"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "995c2e7b-949e-4be7-9000-8138e2b220c8",
|
|
"value": "6ff34f66d54e8e349f9ec9b05a2d8ffb80aa46f1c7ee2cf51d296248d53cf89e"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060584",
|
|
"uuid": "19556fee-a174-4697-ba43-73fde89f550f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "8c9ab266-ff62-4bc7-b637-4008e6a655df",
|
|
"value": "2020-03-18T11:29:12+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "8af7f63d-1803-494d-81a1-040696c2d19e",
|
|
"value": "https://www.virustotal.com/file/6ff34f66d54e8e349f9ec9b05a2d8ffb80aa46f1c7ee2cf51d296248d53cf89e/analysis/1584530952/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "a9e2d709-645d-440c-ae02-f70d149a7472",
|
|
"value": "48/72"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060584",
|
|
"uuid": "bb5ff5a6-c9da-4e5d-8c82-8236abfb7b4e",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "bb5ff5a6-c9da-4e5d-8c82-8236abfb7b4e",
|
|
"referenced_uuid": "361058b9-f2cc-485c-bbc9-43c08acfb535",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060586",
|
|
"uuid": "5e7a1aea-ab94-47c0-8265-45f802de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "e9bf3247-a52d-4651-b524-df96a8c76fc0",
|
|
"value": "34a485d7ab1c84b0f925e88b008b2c53"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "23ef7853-7ae9-4d58-bddf-0ed1644f437d",
|
|
"value": "a457431bb958e563c182ab2804301f66fbb9ca9c"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "593ed4ab-cf6e-4f0e-90c8-5dd6837c4cde",
|
|
"value": "656053240832a63cdd1ae2cffcf2231a0f6ee7406091cedcb94116b594849dbf"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060585",
|
|
"uuid": "361058b9-f2cc-485c-bbc9-43c08acfb535",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "0780afcf-eb32-427d-abc2-c02c8814499a",
|
|
"value": "2020-03-19T04:01:50+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "d78a64e4-4c72-4413-9953-e15c791a3f06",
|
|
"value": "https://www.virustotal.com/file/656053240832a63cdd1ae2cffcf2231a0f6ee7406091cedcb94116b594849dbf/analysis/1584590510/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "1336d755-3294-402b-b66c-3c0d53aca083",
|
|
"value": "49/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060585",
|
|
"uuid": "e1d45267-77c9-4a93-b863-269ae13a7ffa",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "e1d45267-77c9-4a93-b863-269ae13a7ffa",
|
|
"referenced_uuid": "3a343bcb-20bf-408c-b484-25366a9999c7",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060587",
|
|
"uuid": "5e7a1aeb-bfec-4cce-9bf4-4df502de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "0dc66d77-160f-430e-8296-6acf70c5da3b",
|
|
"value": "c93e9d4ebc7cd210003ada07c7bf08b6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "3a4ea439-d2e2-4f60-80ab-26fe618172bf",
|
|
"value": "d81738892dca1a6823da27d886bbdb9f242b3584"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "844be45e-7903-415f-b872-b0d818f5651b",
|
|
"value": "eef8248e20dfa95ac1ceb46bfffd4126d238cd5c244fead8c0991014ffa436f1"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060585",
|
|
"uuid": "3a343bcb-20bf-408c-b484-25366a9999c7",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "a85dd139-a53d-4e31-9303-0af17f9813ad",
|
|
"value": "2020-03-19T06:30:09+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "fd4d8529-aad6-4c6c-a525-a3028116a68f",
|
|
"value": "https://www.virustotal.com/file/eef8248e20dfa95ac1ceb46bfffd4126d238cd5c244fead8c0991014ffa436f1/analysis/1584599409/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "07f81196-2184-49fd-912f-775ccfe96d85",
|
|
"value": "47/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060585",
|
|
"uuid": "61187cb2-d89c-4480-8d84-b2058c6fc2c8",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "61187cb2-d89c-4480-8d84-b2058c6fc2c8",
|
|
"referenced_uuid": "67e97413-2f49-4d8a-8596-90b2ab38a09e",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060587",
|
|
"uuid": "5e7a1aeb-a5bc-4dc6-8952-4fa002de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "d4caf954-40f0-4091-a0aa-a012ba00757a",
|
|
"value": "725e847eca66f9fd882239a73ae066d1"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "3c989644-b865-4a92-8b5c-856213b65b75",
|
|
"value": "abbbe10e3c6e5ed480a0743c540dbaba62ecaaf6"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "3b7ffdb1-834e-46cb-a4d1-4869e3215b43",
|
|
"value": "1d20fca6089bb0f967b4d2b203eee43ae0d9f2d52417d608fb886be8e68dfa92"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060585",
|
|
"uuid": "67e97413-2f49-4d8a-8596-90b2ab38a09e",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "f5559fd0-febb-4cac-9909-f4d1845e4e66",
|
|
"value": "2020-03-16T23:04:04+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "3e881f65-866c-44e4-a7e4-edcb939fe9d8",
|
|
"value": "https://www.virustotal.com/file/1d20fca6089bb0f967b4d2b203eee43ae0d9f2d52417d608fb886be8e68dfa92/analysis/1584399844/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "3ce3c86a-6fd5-493e-a0bb-383a1cbefa7a",
|
|
"value": "32/71"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060585",
|
|
"uuid": "1c206342-00ee-4a05-9851-d871a7fb36f9",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "1c206342-00ee-4a05-9851-d871a7fb36f9",
|
|
"referenced_uuid": "6e46b743-a59f-44fc-8758-aac9654faf1a",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060587",
|
|
"uuid": "5e7a1aeb-0014-4c8e-b1cd-431a02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060309",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "e0d13f70-f60c-481a-a7cf-720fee40bd6b",
|
|
"value": "44a072d0d5f531d245f1d4afdd698045"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060309",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "fb20240b-cd62-4ffe-aa09-13d8481b96fe",
|
|
"value": "1a81675040a7ce679d7802695245a8ea8e6424d3"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060309",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "7c2e624a-6b29-4056-b7ba-30fdb7917349",
|
|
"value": "451e4d4584232f3bce46b448ca6ab1c8210276bfbebd8d254709503c80c960f3"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060586",
|
|
"uuid": "6e46b743-a59f-44fc-8758-aac9654faf1a",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060309",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "f47dd028-cfad-4077-a4e1-5e92d52211cc",
|
|
"value": "2020-03-20T07:01:30+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060309",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "20376095-8886-4d92-91ea-60f1cdacba66",
|
|
"value": "https://www.virustotal.com/file/451e4d4584232f3bce46b448ca6ab1c8210276bfbebd8d254709503c80c960f3/analysis/1584687690/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060309",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "bcdd319a-3ca2-45ad-9ee9-363e55714592",
|
|
"value": "49/73"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "17",
|
|
"timestamp": "1585060586",
|
|
"uuid": "ce558851-5e8d-4e60-b5b1-ec8f05d36c21",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "ce558851-5e8d-4e60-b5b1-ec8f05d36c21",
|
|
"referenced_uuid": "4e863807-bb6e-4a10-9602-84f289931607",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1585060587",
|
|
"uuid": "5e7a1aeb-1d7c-475f-9cb9-4ff202de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5fa6db46-0412-4ebf-a5ad-8c46804369b5",
|
|
"value": "3bf3208b13b3fa71fed6e982ea97ba24"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "9e54a4e3-70fd-48ca-a37c-07ca631c2e08",
|
|
"value": "ab78a81c43b153153de83f432608f8f2e6578341"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1585060310",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "2c8e6f37-e0d9-43f4-b4a5-5fe04885002d",
|
|
"value": "fe1e416fced8f9557f471531c3b7f965d73606f6102e5a339e40237865d60eb4"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1585060586",
|
|
"uuid": "4e863807-bb6e-4a10-9602-84f289931607",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "8e711621-0a71-4ff2-b05a-e3c952828408",
|
|
"value": "2020-03-20T07:25:15+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "199c4dd0-2fa2-4a6e-9b3f-83c7c529f938",
|
|
"value": "https://www.virustotal.com/file/fe1e416fced8f9557f471531c3b7f965d73606f6102e5a339e40237865d60eb4/analysis/1584689115/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "RiskIQ expansion",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1585060310",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "ed6d16cd-57d4-45bf-a05c-a66f5fe8c8eb",
|
|
"value": "46/71"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |